CmdID

CmdID / Files

sdchange.exe

Windows Remote Assistance SD Server file version info

Program on Windows 8 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real sdchange.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionWindows Remote Assistance SD Server

8 known copies

10.0.22000.120 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\sdchange.exe · signed by Microsoft Windows

ad4e1098990bfaba956d5d4d7be68eab2fd3e004f665f0457505440e14e91569

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\sdchange.exe · signed by Microsoft Windows

0dbaa666780695f69a31c11f18ac245cc2627e9574c9d9610b9b735f6a28d9ca

10.0.19041.1110 (WinBuild.160101.0800) · C:\Windows\SysWOW64\sdchange.exe · signed by Microsoft Windows

a4cb0887ae4996564c104535600435b643c2d56f3fc338e95578505fdc150abf

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\sdchange.exe · signed by Microsoft Windows

4113eea6d5998515b9a460c4de0be96bb00de07a36f87cd7215d29932ed02ed7

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\sdchange.exe · signed by Microsoft Windows

77bea7a0371e270b9bfcd6b51433ca8642078bd36e4fdbdb726f9815bf3b6a4f

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\sdchange.exe · signed by Microsoft Windows

b5dd0952e1b8dac257b6af7e3c0674585e834a4b8ef280d730057252592f9879

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\sdchange.exe · signed by Microsoft Windows

62a1b820919688093a0a8936497ce2ecaa3bffd4620b87e5f225da007ea47f82

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\sdchange.exe · signed by Microsoft Windows

c77cf226823b431529aa78ca70442e6faadedbf7dda12b0908bd4908cd06ec42

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.